<!DOCTYPE html>
<html lang="zh-cn" color-mode="light">

  <head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1" />
  <meta name="keywords" content="" />
  <meta name="author" content="郁涛丶" />
  <meta name="description" content="" />
  
  
  <title>
    
      再战PE结构 
      
      
      |
    
     郁涛丶&#39;s Blog
  </title>

  
    <link rel="apple-touch-icon" href="/images/favicon.png">
    <link rel="icon" href="/images/favicon.png">
  

  <!-- Raleway-Font -->
  <link href="https://fonts.googleapis.com/css?family=Raleway&display=swap" rel="stylesheet">

  <!-- hexo site css -->
  
<link rel="stylesheet" href="/css/color-scheme.css">
<link rel="stylesheet" href="/css/base.css">
<link rel="stylesheet" href="//at.alicdn.com/t/font_1886449_67xjft27j1l.css">
<link rel="stylesheet" href="/css/github-markdown.css">
<link rel="stylesheet" href="/css/highlight.css">
<link rel="stylesheet" href="/css/comments.css">

  <!-- 代码块风格 -->
  
    
<link rel="stylesheet" href="/css/figcaption/mac-block.css">

  

  <!-- jquery3.3.1 -->
  
    <script defer type="text/javascript" src="/plugins/jquery.min.js"></script>
  

  <!-- fancybox -->
  
    <link href="/plugins/jquery.fancybox.min.css" rel="stylesheet">
    <script defer type="text/javascript" src="/plugins/jquery.fancybox.min.js"></script>
  
  
<script src="/js/fancybox.js"></script>


  

  <script>
    var html = document.documentElement
    const colorMode = localStorage.getItem('color-mode')
    if (colorMode) {
      document.documentElement.setAttribute('color-mode', colorMode)
    }
  </script>
<!-- hexo injector head_end start -->
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css">

<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/hexo-math@4.0.0/dist/style.css">
<!-- hexo injector head_end end --><meta name="generator" content="Hexo 5.4.0"><link rel="alternate" href="/atom.xml" title="郁涛丶's Blog" type="application/atom+xml">
</head>


  <body>
    <div id="app">
      <div class="header">
  <div class="avatar">
    <a href="/">
      <!-- 头像取消懒加载，添加no-lazy -->
      
        <img src="/images/avatar.png" alt="">
      
    </a>
    <div class="nickname"><a href="/">Ghostasky</a></div>
  </div>
  <div class="navbar">
    <ul>
      
        <li class="nav-item" data-path="/">
          <a href="/">Home</a>
        </li>
      
        <li class="nav-item" data-path="/archives/">
          <a href="/archives/">Archives</a>
        </li>
      
        <li class="nav-item" data-path="/categories/">
          <a href="/categories/">Categories</a>
        </li>
      
        <li class="nav-item" data-path="/tags/">
          <a href="/tags/">Tags</a>
        </li>
      
        <li class="nav-item" data-path="/about/">
          <a href="/about/">About</a>
        </li>
      
    </ul>
  </div>
</div>


<script src="/js/activeNav.js"></script>



      <div class="flex-container">
        <!-- 文章详情页，展示文章具体内容，url形式：https://yoursite/文章标题/ -->
<!-- 同时为「标签tag」，「朋友friend」，「分类categories」，「关于about」页面的承载页面，具体展示取决于page.type -->


    <!-- LaTex Display -->

  
    <script async type="text/javascript" src="https://cdn.jsdelivr.net/npm/mathjax@3/es5/tex-chtml.js"></script>
  
  <script>
    MathJax = {
      tex: {
        inlineMath: [['$', '$'], ['\\(', '\\)']]
      }
    }
  </script>


        
            
                <!-- clipboard -->

  
    <script async type="text/javascript" src="/plugins/clipboard.min.js"></script>
  
  
<script src="/js/codeCopy.js"></script>



                    
                        
                                
                                        
                                                
                                                        
                                                            <!-- 文章内容页 url形式：https://yoursite/文章标题/ -->
                                                            <div class="container post-details" id="post-details">
                                                                <div class="post-content">
                                                                    <div class="post-title">
                                                                        再战PE结构
                                                                    </div>
                                                                    <div class="post-attach">
                                                                        <span class="post-pubtime">
        <i class="iconfont icon-updatetime" title="Update time"></i>
        2021-10-23
      </span>

                                                                        <span class="post-pubtime"> 本文共1.5k字 </span>

                                                                        <span class="post-pubtime">
        大约需要9min
      </span>

                                                                        
                                                                                    <span class="post-categories">
        <i class="iconfont icon-bookmark" title="Categories"></i>
        
        <span class="span--category">
          <a href="/categories/Technology/" title="Technology">
            <b>#</b> Technology
          </a>
        </span>
                                                                                    
                                                                                        </span>
                                                                                        
                                                                            <span class="post-tags">
        <i class="iconfont icon-tags" title="Tags"></i>
        
        <span class="span--tag">
          <a href="/tags/RE/" title="RE">
            <b>#</b> RE
          </a>
        </span>
                                                                            
                                                                                </span>
                                                                                
                                                                    </div>
                                                                    <div class="markdown-body">
                                                                        <p>[toc]</p>
<h1 id="PE文件结构解析"><a href="#PE文件结构解析" class="headerlink" title="PE文件结构解析"></a>PE文件结构解析</h1><h2 id="0-总述"><a href="#0-总述" class="headerlink" title="0.总述"></a>0.总述</h2><p>大致结构如下：</p>
<ol>
<li>DOS头（占位），仅适用于映像文件</li>
<li>DOS存根（又叫签名），仅适用于映像文件</li>
<li>COFF文件头，适用于映像文件和目标文件</li>
<li>NT（可选文件头），仅适用于映像文件</li>
<li>节表（节区头）</li>
<li>节</li>
</ol>
<p>其中，PE头包含DOS头、DOS存根、NT头、节表。</p>
<p>用到的结构体都在<code>winnt.h</code>头文件中。</p>
<h2 id="1-DOS头"><a href="#1-DOS头" class="headerlink" title="1.DOS头"></a>1.DOS头</h2><p>Mz那里</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">typedef</span> <span class="class"><span class="keyword">struct</span> _<span class="title">IMAGE_DOS_HEADER</span> &#123;</span>      <span class="comment">// DOS .EXE header</span></span><br><span class="line">    WORD   e_magic;                     <span class="comment">// Magic number</span></span><br><span class="line">    WORD   e_cblp;                      <span class="comment">// Bytes on last page of file</span></span><br><span class="line">    WORD   e_cp;                        <span class="comment">// Pages in file</span></span><br><span class="line">    WORD   e_crlc;                      <span class="comment">// Relocations</span></span><br><span class="line">    WORD   e_cparhdr;                   <span class="comment">// Size of header in paragraphs</span></span><br><span class="line">    WORD   e_minalloc;                  <span class="comment">// Minimum extra paragraphs needed</span></span><br><span class="line">    WORD   e_maxalloc;                  <span class="comment">// Maximum extra paragraphs needed</span></span><br><span class="line">    WORD   e_ss;                        <span class="comment">// Initial (relative) SS value</span></span><br><span class="line">    WORD   e_sp;                        <span class="comment">// Initial SP value</span></span><br><span class="line">    WORD   e_csum;                      <span class="comment">// Checksum</span></span><br><span class="line">    WORD   e_ip;                        <span class="comment">// Initial IP value</span></span><br><span class="line">    WORD   e_cs;                        <span class="comment">// Initial (relative) CS value</span></span><br><span class="line">    WORD   e_lfarlc;                    <span class="comment">// File address of relocation table</span></span><br><span class="line">    WORD   e_ovno;                      <span class="comment">// Overlay number</span></span><br><span class="line">    WORD   e_res[<span class="number">4</span>];                    <span class="comment">// Reserved words</span></span><br><span class="line">    WORD   e_oemid;                     <span class="comment">// OEM identifier (for e_oeminfo)</span></span><br><span class="line">    WORD   e_oeminfo;                   <span class="comment">// OEM information; e_oemid specific</span></span><br><span class="line">    WORD   e_res2[<span class="number">10</span>];                  <span class="comment">// Reserved words</span></span><br><span class="line">    LONG   e_lfanew;                    <span class="comment">// File address of new exe header</span></span><br><span class="line">  &#125; IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;</span><br></pre></td></tr></table></figure>

<p>重要的只有最后的：<code>e_lfanew</code>，表示NT头的偏移</p>
<h2 id="2-DOS存根"><a href="#2-DOS存根" class="headerlink" title="2.DOS存根"></a>2.DOS存根</h2><p>就是<code>This program cannot be run in DOS mode.</code>那里，</p>
<h2 id="4-NT头"><a href="#4-NT头" class="headerlink" title="4.NT头"></a>4.NT头</h2><p>以下为<code>notepad.exe</code>的NT头：</p>
<p><img src="/2021/10/23/PE%E6%96%87%E4%BB%B6%E7%BB%93%E6%9E%84%E8%A7%A3%E6%9E%90/image-20211019192747065.png" alt="image-20211019192747065"></p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">typedef</span> <span class="class"><span class="keyword">struct</span> _<span class="title">IMAGE_NT_HEADERS64</span> &#123;</span></span><br><span class="line">    DWORD Signature;</span><br><span class="line">    IMAGE_FILE_HEADER FileHeader;</span><br><span class="line">    IMAGE_OPTIONAL_HEADER64 OptionalHeader;</span><br><span class="line">&#125; IMAGE_NT_HEADERS64, *PIMAGE_NT_HEADERS64;</span><br><span class="line"></span><br><span class="line"><span class="keyword">typedef</span> <span class="class"><span class="keyword">struct</span> _<span class="title">IMAGE_NT_HEADERS</span> &#123;</span></span><br><span class="line">    DWORD Signature;</span><br><span class="line">    IMAGE_FILE_HEADER FileHeader;</span><br><span class="line">    IMAGE_OPTIONAL_HEADER32 OptionalHeader;</span><br><span class="line">&#125; IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;</span><br></pre></td></tr></table></figure>

<p>由3部分构成：签名，文件头，可选头</p>
<p>其中Signature就是上面的PE:<code>504B</code>。</p>
<p>下面是文件头<code>IMAGE_FILE_HEADER</code>:</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">typedef</span> <span class="class"><span class="keyword">struct</span> _<span class="title">IMAGE_FILE_HEADER</span></span></span><br><span class="line"><span class="class">&#123;</span></span><br><span class="line">    WORD Machine;</span><br><span class="line">    WORD NumberOfSections; <span class="comment">//节的数目</span></span><br><span class="line">    DWORD TimeDateStamp;</span><br><span class="line">    DWORD PointerToSymbolTable; <span class="comment">//符号表的文件offset</span></span><br><span class="line">    DWORD NumberOfSymbols;      <span class="comment">//符号表中元素数目</span></span><br><span class="line">    WORD SizeOfOptionalHeader;  <span class="comment">//指出下面结构体IMAGE_OPTIONAL_HEADER32（32位系统）的长度</span></span><br><span class="line">    WORD Characteristics;       <span class="comment">//标识文件属性，文件是否是可运行形态、是否为DLL等，以bit OR形式进行组合</span></span><br><span class="line">&#125; IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;</span><br></pre></td></tr></table></figure>

<p>接下来是可选头：</p>
<p>前几个是标准，后面的是可选</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">typedef</span> <span class="class"><span class="keyword">struct</span> _<span class="title">IMAGE_OPTIONAL_HEADER</span></span></span><br><span class="line"><span class="class">&#123;</span></span><br><span class="line">    <span class="comment">//</span></span><br><span class="line">    <span class="comment">// Standard fields.</span></span><br><span class="line">    <span class="comment">//</span></span><br><span class="line"></span><br><span class="line">    WORD Magic; <span class="comment">//32位为0x10B,64位为0x20B</span></span><br><span class="line">    BYTE MajorLinkerVersion;</span><br><span class="line">    BYTE MinorLinkerVersion;</span><br><span class="line">    DWORD SizeOfCode;              <span class="comment">//代码节(.test)大小，有多个的话是总和</span></span><br><span class="line">    DWORD SizeOfInitializedData;   <span class="comment">//已初始化数据节的大小，有多个的话是总和</span></span><br><span class="line">    DWORD SizeOfUninitializedData; <span class="comment">//未初始化数据节的大小，有多个的话是总和</span></span><br><span class="line">    DWORD AddressOfEntryPoint;     <span class="comment">//EP的RVA值</span></span><br><span class="line">    DWORD BaseOfCode;              <span class="comment">//内存中代码节的开头相对于映像基址的偏移地址。</span></span><br><span class="line">    DWORD BaseOfData;</span><br><span class="line"></span><br><span class="line">    <span class="comment">//</span></span><br><span class="line">    <span class="comment">// NT additional fields.</span></span><br><span class="line">    <span class="comment">//</span></span><br><span class="line"></span><br><span class="line">    DWORD ImageBase;        <span class="comment">//载入内存时优先装载的地址</span></span><br><span class="line">    DWORD SectionAlignment; <span class="comment">//节区在内存中的最小单位</span></span><br><span class="line">    DWORD FileAlignment;    <span class="comment">//节区在磁盘文件中的最小单位</span></span><br><span class="line">    WORD MajorOperatingSystemVersion;</span><br><span class="line">    WORD MinorOperatingSystemVersion;</span><br><span class="line">    WORD MajorImageVersion;</span><br><span class="line">    WORD MinorImageVersion;</span><br><span class="line">    WORD MajorSubsystemVersion;</span><br><span class="line">    WORD MinorSubsystemVersion;</span><br><span class="line">    DWORD Win32VersionValue;</span><br><span class="line">    DWORD SizeOfImage;   <span class="comment">//指定了PE Image在虚拟内存中所占空间的大小，包含所有头</span></span><br><span class="line">    DWORD SizeOfHeaders; <span class="comment">//整个PE头的大小</span></span><br><span class="line">    DWORD CheckSum;</span><br><span class="line">    WORD Subsystem;</span><br><span class="line">    WORD DllCharacteristics;</span><br><span class="line">    DWORD SizeOfStackReserve;</span><br><span class="line">    DWORD SizeOfStackCommit;</span><br><span class="line">    DWORD SizeOfHeapReserve;</span><br><span class="line">    DWORD SizeOfHeapCommit;</span><br><span class="line">    DWORD LoaderFlags;</span><br><span class="line">    DWORD NumberOfRvaAndSizes;                                            <span class="comment">//下面数组的个数</span></span><br><span class="line">    IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; <span class="comment">//16个</span></span><br><span class="line">&#125; IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;</span><br><span class="line"></span><br><span class="line"><span class="keyword">typedef</span> <span class="class"><span class="keyword">struct</span> _<span class="title">IMAGE_DATA_DIRECTORY</span></span></span><br><span class="line"><span class="class">&#123;</span></span><br><span class="line">    DWORD VirtualAddress; <span class="comment">//表的RVA</span></span><br><span class="line">    DWORD Size;</span><br><span class="line">&#125; IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;</span><br></pre></td></tr></table></figure>

<h2 id="5-节表"><a href="#5-节表" class="headerlink" title="5.节表"></a>5.节表</h2><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">typedef</span> <span class="class"><span class="keyword">struct</span> _<span class="title">IMAGE_SECTION_HEADER</span></span></span><br><span class="line"><span class="class">&#123;</span></span><br><span class="line">    BYTE Name[IMAGE_SIZEOF_SHORT_NAME]; <span class="comment">//8</span></span><br><span class="line">    <span class="class"><span class="keyword">union</span></span></span><br><span class="line"><span class="class">    &#123;</span></span><br><span class="line">        DWORD PhysicalAddress;</span><br><span class="line">        DWORD VirtualSize; <span class="comment">//载入内存时此节区的大小</span></span><br><span class="line">    &#125; Misc;</span><br><span class="line">    DWORD VirtualAddress;   <span class="comment">//内存中节区起始地址(RVA)</span></span><br><span class="line">    DWORD SizeOfRawData;    <span class="comment">//磁盘中节区所占大小</span></span><br><span class="line">    DWORD PointerToRawData; <span class="comment">//磁盘中本节对于文件头的距离</span></span><br><span class="line">    DWORD PointerToRelocations;</span><br><span class="line">    DWORD PointerToLinenumbers;</span><br><span class="line">    WORD NumberOfRelocations;</span><br><span class="line">    WORD NumberOfLinenumbers;</span><br><span class="line">    DWORD Characteristics;</span><br><span class="line">&#125; IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;</span><br></pre></td></tr></table></figure>

<h2 id="6-RVA与RAW地址转换"><a href="#6-RVA与RAW地址转换" class="headerlink" title="6.RVA与RAW地址转换"></a>6.RVA与RAW地址转换</h2><p><strong>RAW - PointerToRawData &#x3D; RVA - VirtualAddress</strong></p>
<p><strong>RAW &#x3D; RVA - VirtualAddress + PointerToRawData</strong></p>
<p>rva &#x3D; RAW - PointerToRawData + VirtualAddress</p>
<h1 id="IAT表分析"><a href="#IAT表分析" class="headerlink" title="IAT表分析"></a>IAT表分析</h1><p>首先是INT和IAT导入的步骤：</p>
<ol>
<li>读<code>IMAGE_IMPORT_DESCRIPTOR</code>的<code>Name</code>成员获取库名称的字符串(比如’kernel32.dll’)</li>
<li>装载相应的库，LoadLibrary(“kernel32.dll”)</li>
<li>读<code>IMAGE_IMPORT_DESCRIPTOR</code>的<code>OriginalFirstThunk</code>成员，获得INT表的地址</li>
<li>逐一获取INT数组的<code>IMAGE_IMPORT_BY_NAME</code>地址</li>
<li>使用<code>IMAGE_IMPORT_BY_NAME</code>的hint或者name项，获取相应函数的起始地址</li>
<li>读<code>IMAGE_IMPORT_DESCRIPTOR</code>的<code>FirstThunk</code>(IAT)，获取IAT的地址</li>
<li>将上面获得的函数地址输入相应的IAT数组值</li>
<li>重复4~7</li>
</ol>
<p>导入表、导入地址表(<code>IMPORT ADDRESS TABLE</code>)，导入表在上面16个数组的第2个。</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">typedef</span> <span class="class"><span class="keyword">struct</span> _<span class="title">IMAGE_DATA_DIRECTORY</span></span></span><br><span class="line"><span class="class">&#123;</span></span><br><span class="line">    DWORD VirtualAddress; <span class="comment">//该表的RVA</span></span><br><span class="line">    DWORD Size;</span><br><span class="line">&#125; IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;</span><br></pre></td></tr></table></figure>

<p><img src="/2021/10/23/PE%E6%96%87%E4%BB%B6%E7%BB%93%E6%9E%84%E8%A7%A3%E6%9E%90/image-20211020202318348.png" alt="image-20211020202318348"></p>
<p>可以看出导入表的RVA为0x2647C，在.idata段，</p>
<p>那么RAW&#x3D; 0x2647C - 0x26000 + 0x23200 &#x3D;0x2367C</p>
<p><img src="/2021/10/23/PE%E6%96%87%E4%BB%B6%E7%BB%93%E6%9E%84%E8%A7%A3%E6%9E%90/image-20211021075308064.png" alt="image-20211021075308064"></p>
<p>有多少导入的库就有多少<code>IMAGE_IMPORT_DESCRIPTOR</code>结构体：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">typedef</span> <span class="class"><span class="keyword">struct</span> _<span class="title">IMAGE_IMPORT_DESCRIPTOR</span></span></span><br><span class="line"><span class="class">&#123;</span></span><br><span class="line">    <span class="class"><span class="keyword">union</span></span></span><br><span class="line"><span class="class">    &#123;</span></span><br><span class="line">        DWORD Characteristics;    <span class="comment">// 0 for terminating null import descriptor</span></span><br><span class="line">        DWORD OriginalFirstThunk; <span class="comment">// INT address(RVA)，数组，指向IMAGE_IMPORT_BY_NAME结构体</span></span><br><span class="line">    &#125; DUMMYUNIONNAME;</span><br><span class="line">    DWORD TimeDateStamp;</span><br><span class="line">    DWORD ForwarderChain;</span><br><span class="line">    DWORD Name;       <span class="comment">//library name string address(RVA)</span></span><br><span class="line">    DWORD FirstThunk; <span class="comment">//IAT address(RVA)，数组，指向IMAGE_IMPORT_BY_NAME结构体</span></span><br><span class="line">&#125; IMAGE_IMPORT_DESCRIPTOR;</span><br><span class="line"></span><br><span class="line"><span class="keyword">typedef</span> <span class="class"><span class="keyword">struct</span> _<span class="title">IMAGE_IMPORT_BY_NAME</span> &#123;</span></span><br><span class="line">    WORD    Hint;<span class="comment">//可能为0，编译器决定，如果不为0，是函数在导出表中的索引</span></span><br><span class="line">    CHAR   Name[<span class="number">1</span>];</span><br><span class="line">&#125; IMAGE_IMPORT_BY_NAME, *PIMAGE_IMPORT_BY_NAME;</span><br></pre></td></tr></table></figure>

<p>程序加载前IAT和INT都之指向同一个位置。</p>
<p><img src="/2021/10/23/PE%E6%96%87%E4%BB%B6%E7%BB%93%E6%9E%84%E8%A7%A3%E6%9E%90/SouthEast.png" alt="这里写图片描述"></p>
<p>每个库只有一个<code>IMAGE_IMPORT_DESCRIPTOR</code>，但是每个该结构体的<code>INT(OriginalFirstThunk)</code>和<code>IAT(FirstThunk)</code>为数组，表示该库所有导入的API的地址:</p>
<p><img src="/2021/10/23/PE%E6%96%87%E4%BB%B6%E7%BB%93%E6%9E%84%E8%A7%A3%E6%9E%90/image-20211021075648706.png" alt="image-20211021075648706"></p>
<p>INT的RAW&#x3D; 0x26700 -  0x26000 + 0x23200  &#x3D; 0x23900</p>
<p><img src="/2021/10/23/PE%E6%96%87%E4%BB%B6%E7%BB%93%E6%9E%84%E8%A7%A3%E6%9E%90/image-20211021080941861.png" alt="image-20211021080941861"></p>
<p>上面都是需要导入的INT的<code>IMAGE_IMPORT_BY_NAME</code>的地址，比如第一个0x26D3C:</p>
<p>RAW&#x3D; 0x26D3C-  0x26000 + 0x23200 &#x3D;0x23F3C</p>
<p><img src="/2021/10/23/PE%E6%96%87%E4%BB%B6%E7%BB%93%E6%9E%84%E8%A7%A3%E6%9E%90/image-20211021081249113.png" alt="image-20211021081249113"></p>
<p>INT就是上面那样，IAT也是如此</p>
<p>上面都是导入前，导入后INT不变，IAT为函数的地址：</p>
<p><img src="/2021/10/23/PE%E6%96%87%E4%BB%B6%E7%BB%93%E6%9E%84%E8%A7%A3%E6%9E%90/SouthEast.png" alt="这里写图片描述"></p>
<h1 id="导出表分析"><a href="#导出表分析" class="headerlink" title="导出表分析"></a>导出表分析</h1><p>在上面16个数组的第一个，这里拿kernel32.dll来测试（notepad没有导出表</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">typedef</span> <span class="class"><span class="keyword">struct</span> _<span class="title">IMAGE_EXPORT_DIRECTORY</span></span></span><br><span class="line"><span class="class">&#123;</span></span><br><span class="line">    DWORD Characteristics;</span><br><span class="line">    DWORD TimeDateStamp;</span><br><span class="line">    WORD MajorVersion;</span><br><span class="line">    WORD MinorVersion;</span><br><span class="line">    DWORD Name;                  <span class="comment">//要导出的名字的地址</span></span><br><span class="line">    DWORD Base;                  <span class="comment">//oridinal base</span></span><br><span class="line">    DWORD NumberOfFunctions;     <span class="comment">//实际导出函数个数</span></span><br><span class="line">    DWORD NumberOfNames;         <span class="comment">//导出函数中有名字的个数</span></span><br><span class="line">    DWORD AddressOfFunctions;    <span class="comment">//导出函数的地址(数组，RVA，元素个数=NumberOfFunctions )</span></span><br><span class="line">    DWORD AddressOfNames;        <span class="comment">//导出函数的名称的地址(数组，RVA，元素个数=NumberOfNames)</span></span><br><span class="line">    DWORD AddressOfNameOrdinals; <span class="comment">//导出函数序号表的地址(数组，RVA，元素个数=NumberOfNames)，函数序号表</span></span><br><span class="line">&#125; IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;</span><br></pre></td></tr></table></figure>

<p>获得函数地址的API为：<code>GetProcAddress</code>，原理：</p>
<blockquote>
<ol>
<li>利用adressofname转到函数名称的数组</li>
<li>上面的数组存着的是地址，通过strcmp，查到指定的函数名，这时索引记为name_index</li>
<li>用addressofnameordinals转到ordinal数组，</li>
<li>通过name_index查找相应index值</li>
<li>利用addressoffunction转到 函数地址数组</li>
<li>用ordinal找到需要函数的地址。</li>
</ol>
</blockquote>
<p>图胜千言</p>
<p><img src="/2021/10/23/PE%E6%96%87%E4%BB%B6%E7%BB%93%E6%9E%84%E8%A7%A3%E6%9E%90/1586953-20200217214947470-1447184500.png" alt="img"></p>
<p><img src="/2021/10/23/PE%E6%96%87%E4%BB%B6%E7%BB%93%E6%9E%84%E8%A7%A3%E6%9E%90/779730_7HXD6CYRBH5QTP4.jpg" alt="eat3"></p>
<p><img src="/2021/10/23/PE%E6%96%87%E4%BB%B6%E7%BB%93%E6%9E%84%E8%A7%A3%E6%9E%90/SouthEast.png" alt="img"></p>
<h2 id="示例"><a href="#示例" class="headerlink" title="示例"></a>示例</h2><p>下面实际找一下，使用kernel32.dll，找AddConsoleAlisaA函数：</p>
<p><img src="/2021/10/23/PE%E6%96%87%E4%BB%B6%E7%BB%93%E6%9E%84%E8%A7%A3%E6%9E%90/image-20211102123648075.png" alt="image-20211102123648075"></p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">AddressOfFunctions :   RVA = <span class="number">0x2654</span>  FOA = <span class="number">0x1A54</span></span><br><span class="line">AddressOfNames:        RVA = <span class="number">0x3538</span>  FOA = <span class="number">0x2938</span></span><br><span class="line">AddressOfNameOrdinals: RVA = <span class="number">0x441C</span>  FOA = <span class="number">0x381C</span></span><br></pre></td></tr></table></figure>

<h3 id="AddressOfName"><a href="#AddressOfName" class="headerlink" title="AddressOfName"></a>AddressOfName</h3><p>是一个个的RVA，个数为0x953，经过转换，FOA &#x3D; 0x2938：</p>
<p><img src="/2021/10/23/PE%E6%96%87%E4%BB%B6%E7%BB%93%E6%9E%84%E8%A7%A3%E6%9E%90/image-20211102123953820.png" alt="image-20211102123953820"></p>
<p>RVA &#x3D; 4B9B &#x3D;&#x3D;&gt; FOA &#x3D; 3F9B ：</p>
<p><img src="/2021/10/23/PE%E6%96%87%E4%BB%B6%E7%BB%93%E6%9E%84%E8%A7%A3%E6%9E%90/image-20211102124237902.png" alt="image-20211102124237902"></p>
<p>是第4个，索引为3，</p>
<h3 id="AddressOfNameOrdinals"><a href="#AddressOfNameOrdinals" class="headerlink" title="AddressOfNameOrdinals"></a>AddressOfNameOrdinals</h3><p><img src="/2021/10/23/PE%E6%96%87%E4%BB%B6%E7%BB%93%E6%9E%84%E8%A7%A3%E6%9E%90/image-20211102124406631.png" alt="image-20211102124406631"></p>
<p>索引和值是一样的，也是第4个，下面查地址：</p>
<h3 id="AddressOfFunctions"><a href="#AddressOfFunctions" class="headerlink" title="AddressOfFunctions"></a>AddressOfFunctions</h3><p><img src="/2021/10/23/PE%E6%96%87%E4%BB%B6%E7%BB%93%E6%9E%84%E8%A7%A3%E6%9E%90/image-20211102124531765.png" alt="image-20211102124531765"></p>
<p>第4个是0x071cdf，kernel32.dll的imagebase是0x7c800000，加起来是’0x7c871cdf’</p>
<p><img src="/2021/10/23/PE%E6%96%87%E4%BB%B6%E7%BB%93%E6%9E%84%E8%A7%A3%E6%9E%90/image-20211102124718782.png" alt="image-20211102124718782"></p>
<h1 id="重定位表"><a href="#重定位表" class="headerlink" title="重定位表"></a>重定位表</h1>
                                                                    </div>
                                                                    
                                                                        <div class="prev-or-next">
                                                                            <div class="post-foot-next">
                                                                                
                                                                                    <a href="/2021/10/17/BUU-PWN-0x40-0x4F/" target="_self">
                                                                                        <i class="iconfont icon-chevronleft"></i>
                                                                                        <span>Prev</span>
                                                                                    </a>
                                                                                    
                                                                            </div>
                                                                            <div class="post-attach">
                                                                                <!-- <span class="post-pubtime">
              <i class="iconfont icon-updatetime" title="Update time"></i>
              2021-10-23
            </span> -->

                                                                                
                                                                                            <span class="post-categories">
          <!-- <i class="iconfont icon-bookmark" title="Categories"></i> -->
          
          <!-- <span class="span--category">
            <a href="/categories/Technology/" title="Technology">
              <b>#</b> Technology
            </a>
          </span> -->
                                                                                            
                                                                                                </span>
                                                                                                
                                                                                    <span class="post-tags">
          <!-- <i class="iconfont icon-tags" title="Tags"></i> -->
          
          <!-- <span class="span--tag">
            <a href="/tags/RE/" title="RE">
              <b>#</b> RE
            </a>
          </span> -->
                                                                                    
                                                                                        </span>
                                                                                        
                                                                            </div>
                                                                            <div class="post-foot-prev">
                                                                                
                                                                                    <a href="/2021/11/07/BUU-RE-0x01-0x1F/" target="_self">
                                                                                        <span>Next</span>
                                                                                        <i class="iconfont icon-chevronright"></i>
                                                                                    </a>
                                                                                    
                                                                            </div>
                                                                        </div>
                                                                        
                                                                </div>
                                                                
  <div id="btn-catalog" class="btn-catalog">
    <i class="iconfont icon-catalog"></i>
  </div>
  <div class="post-catalog hidden" id="catalog">
    <div class="title">Contents</div>
    <div class="catalog-content">
      
        <ol class="toc"><li class="toc-item toc-level-1"><a class="toc-link" href="#PE%E6%96%87%E4%BB%B6%E7%BB%93%E6%9E%84%E8%A7%A3%E6%9E%90"><span class="toc-text">PE文件结构解析</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#0-%E6%80%BB%E8%BF%B0"><span class="toc-text">0.总述</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#1-DOS%E5%A4%B4"><span class="toc-text">1.DOS头</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#2-DOS%E5%AD%98%E6%A0%B9"><span class="toc-text">2.DOS存根</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#4-NT%E5%A4%B4"><span class="toc-text">4.NT头</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#5-%E8%8A%82%E8%A1%A8"><span class="toc-text">5.节表</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#6-RVA%E4%B8%8ERAW%E5%9C%B0%E5%9D%80%E8%BD%AC%E6%8D%A2"><span class="toc-text">6.RVA与RAW地址转换</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#IAT%E8%A1%A8%E5%88%86%E6%9E%90"><span class="toc-text">IAT表分析</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#%E5%AF%BC%E5%87%BA%E8%A1%A8%E5%88%86%E6%9E%90"><span class="toc-text">导出表分析</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#%E7%A4%BA%E4%BE%8B"><span class="toc-text">示例</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#AddressOfName"><span class="toc-text">AddressOfName</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#AddressOfNameOrdinals"><span class="toc-text">AddressOfNameOrdinals</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#AddressOfFunctions"><span class="toc-text">AddressOfFunctions</span></a></li></ol></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#%E9%87%8D%E5%AE%9A%E4%BD%8D%E8%A1%A8"><span class="toc-text">重定位表</span></a></li></ol>
      
    </div>
  </div>

  
<script src="/js/catalog.js"></script>




                                                                    
                                                                        <div class="comments-container">
                                                                            







                                                                        </div>
                                                                        
                                                            </div>
                                                            
        
<div class="footer">
  <div class="social">
    <ul>
      
        <li>
          <a title="github" target="_blank" rel="noopener" href="https://github.com/Ghostasky">
            <i class="iconfont icon-github"></i>
          </a>
        </li>
      
        <li>
          <a title="twitter" target="_blank" rel="noopener" href="https://twitter.com/ghostasky">
            <i class="iconfont icon-twitter"></i>
          </a>
        </li>
      
    </ul>
  </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/Ghostasky">怕什么真理无穷，进一寸有进一寸的欢喜。</a>
        
    </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/zchengsite/hexo-theme-oranges">Copyright © 2022 Oranges</a>
        
    </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/zchengsite/hexo-theme-oranges">Theme by Oranges | Powered by Hexo</a>
        
    </div>
  
</div>

      </div>

      <div class="tools-bar">
        <div class="back-to-top tools-bar-item hidden">
  <a href="javascript: void(0)">
    <i class="iconfont icon-chevronup"></i>
  </a>
</div>


<script src="/js/backtotop.js"></script>



        
  <div class="search-icon tools-bar-item" id="search-icon">
    <a href="javascript: void(0)">
      <i class="iconfont icon-search"></i>
    </a>
  </div>

  <div class="search-overlay hidden">
    <div class="search-content" tabindex="0">
      <div class="search-title">
        <span class="search-icon-input">
          <a href="javascript: void(0)">
            <i class="iconfont icon-search"></i>
          </a>
        </span>
        
          <input type="text" class="search-input" id="search-input" placeholder="Search...">
        
        <span class="search-close-icon" id="search-close-icon">
          <a href="javascript: void(0)">
            <i class="iconfont icon-close"></i>
          </a>
        </span>
      </div>
      <div class="search-result" id="search-result"></div>
    </div>
  </div>

  <script type="text/javascript">
    var inputArea = document.querySelector("#search-input")
    var searchOverlayArea = document.querySelector(".search-overlay")

    inputArea.onclick = function() {
      getSearchFile()
      this.onclick = null
    }

    inputArea.onkeydown = function() {
      if(event.keyCode == 13)
        return false
    }

    function openOrHideSearchContent() {
      let isHidden = searchOverlayArea.classList.contains('hidden')
      if (isHidden) {
        searchOverlayArea.classList.remove('hidden')
        document.body.classList.add('hidden')
        // inputArea.focus()
      } else {
        searchOverlayArea.classList.add('hidden')
        document.body.classList.remove('hidden')
      }
    }

    function blurSearchContent(e) {
      if (e.target === searchOverlayArea) {
        openOrHideSearchContent()
      }
    }

    document.querySelector("#search-icon").addEventListener("click", openOrHideSearchContent, false)
    document.querySelector("#search-close-icon").addEventListener("click", openOrHideSearchContent, false)
    searchOverlayArea.addEventListener("click", blurSearchContent, false)

    var searchFunc = function (path, search_id, content_id) {
      'use strict';
      var $input = document.getElementById(search_id);
      var $resultContent = document.getElementById(content_id);
      $resultContent.innerHTML = "<ul><span class='local-search-empty'>First search, index file loading, please wait...<span></ul>";
      $.ajax({
        // 0x01. load xml file
        url: path,
        dataType: "xml",
        success: function (xmlResponse) {
          // 0x02. parse xml file
          var datas = $("entry", xmlResponse).map(function () {
            return {
              title: $("title", this).text(),
              content: $("content", this).text(),
              url: $("url", this).text()
            };
          }).get();
          $resultContent.innerHTML = "";

          $input.addEventListener('input', function () {
            // 0x03. parse query to keywords list
            var str = '<ul class=\"search-result-list\">';
            var keywords = this.value.trim().toLowerCase().split(/[\s\-]+/);
            $resultContent.innerHTML = "";
            if (this.value.trim().length <= 0) {
              return;
            }
            // 0x04. perform local searching
            datas.forEach(function (data) {
              var isMatch = true;
              var content_index = [];
              if (!data.title || data.title.trim() === '') {
                data.title = "Untitled";
              }
              var orig_data_title = data.title.trim();
              var data_title = orig_data_title.toLowerCase();
              var orig_data_content = data.content.trim().replace(/<[^>]+>/g, "");
              var data_content = orig_data_content.toLowerCase();
              var data_url = data.url;
              var index_title = -1;
              var index_content = -1;
              var first_occur = -1;
              // only match artiles with not empty contents
              if (data_content !== '') {
                keywords.forEach(function (keyword, i) {
                  index_title = data_title.indexOf(keyword);
                  index_content = data_content.indexOf(keyword);

                  if (index_title < 0 && index_content < 0) {
                    isMatch = false;
                  } else {
                    if (index_content < 0) {
                      index_content = 0;
                    }
                    if (i == 0) {
                      first_occur = index_content;
                    }
                    // content_index.push({index_content:index_content, keyword_len:keyword_len});
                  }
                });
              } else {
                isMatch = false;
              }
              // 0x05. show search results
              if (isMatch) {
                str += "<li><a href='" + data_url + "' class='search-result-title'>" + orig_data_title + "</a>";
                var content = orig_data_content;
                if (first_occur >= 0) {
                  // cut out 100 characters
                  var start = first_occur - 20;
                  var end = first_occur + 80;

                  if (start < 0) {
                    start = 0;
                  }

                  if (start == 0) {
                    end = 100;
                  }

                  if (end > content.length) {
                    end = content.length;
                  }

                  var match_content = content.substr(start, end);

                  // highlight all keywords
                  keywords.forEach(function (keyword) {
                    var regS = new RegExp(keyword, "gi");
                    match_content = match_content.replace(regS, "<span class=\"search-keyword\">" + keyword + "</span>");
                  });

                  str += "<p class=\"search-result-abstract\">" + match_content + "...</p>"
                }
                str += "</li>";
              }
            });
            str += "</ul>";
            if (str.indexOf('<li>') === -1) {
              return $resultContent.innerHTML = "<ul><span class='local-search-empty'>No result<span></ul>";
            }
            $resultContent.innerHTML = str;
          });
        },
        error: function(xhr, status, error) {
          $resultContent.innerHTML = ""
          if (xhr.status === 404) {
            $resultContent.innerHTML = "<ul><span class='local-search-empty'>The search.xml file was not found, please refer to：<a href='https://github.com/zchengsite/hexo-theme-oranges#configuration' target='_black'>configuration</a><span></ul>";
          } else {
            $resultContent.innerHTML = "<ul><span class='local-search-empty'>The request failed, Try to refresh the page or try again later.<span></ul>";
          }
        }
      });
      $(document).on('click', '#search-close-icon', function() {
        $('#search-input').val('');
        $('#search-result').html('');
      });
    }

    var getSearchFile = function() {
        var path = "/search.xml";
        searchFunc(path, 'search-input', 'search-result');
    }
  </script>




        
  <div class="tools-bar-item theme-icon" id="switch-color-scheme">
    <a href="javascript: void(0)">
      <i id="theme-icon" class="iconfont icon-moon"></i>
    </a>
  </div>

  
<script src="/js/colorscheme.js"></script>





        
  
    <div class="share-icon tools-bar-item">
      <a href="javascript: void(0)" id="share-icon">
        <i class="iconfont iconshare"></i>
      </a>
      <div class="share-content hidden">
        
          <a class="share-item" href="https://twitter.com/intent/tweet?text=' + %E5%86%8D%E6%88%98PE%E7%BB%93%E6%9E%84 + '&url=' + https%3A%2F%2Fghostasky.github.io%2F2021%2F10%2F23%2FPE%25E6%2596%2587%25E4%25BB%25B6%25E7%25BB%2593%25E6%259E%2584%25E8%25A7%25A3%25E6%259E%2590%2F + '" target="_blank" title="Twitter">
            <i class="iconfont icon-twitter"></i>
          </a>
        
        
          <a class="share-item" href="https://www.facebook.com/sharer.php?u=https://ghostasky.github.io/2021/10/23/PE%E6%96%87%E4%BB%B6%E7%BB%93%E6%9E%84%E8%A7%A3%E6%9E%90/" target="_blank" title="Facebook">
            <i class="iconfont icon-facebooksquare"></i>
          </a>
        
      </div>
    </div>
  
  
<script src="/js/shares.js"></script>



      </div>
    </div>
  </body>
</html>
